CVE-2019-10307

CWE-352 — Cross-Site Request Forgery (CSRF)5 documents5 sources

Severity

6.5MEDIUM

EPSS

0.2%

top 59.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Static Analysis Utilities Jenkins Project Jenkins Static Analysis Utilities Plugin

Timeline

PublishedApr 30

Latest updateMay 24

Description

A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_static_analysis_utilities_plugin1.95 and earlier

▶NVDjenkins/static_analysis_utilities1.95

▶Mavenorg.jvnet.hudson.plugins:analysis-core< 1.96

🔴Vulnerability Details

GHSA

Jenkins Static Analysis Utilities Plugin is vulnerable to Cross-site request forgery vulnerability↗2022-05-24

▶

OSV

Jenkins Static Analysis Utilities Plugin is vulnerable to Cross-site request forgery vulnerability↗2022-05-24

▶

CVEList

CVE-2019-10307: A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1↗2019-04-30

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2019-04-30↗2019-04-30

▶